SuSE 8.0 system crash; strange characters in access_log
Dear people, I'm only an amateurish part-time sysadmin, so please bear with me. This weekend our web server (SuSE 8.0) crashed. The machine could be pinged, but did not respond to http or ssh requests. When I came in this morning, I could not get the screen to wake up, so I had to forcibly reboot the machine. After rebooting, I checked the logfiles (at least those that I know about) and the only one in which something strange appeared was Apaches access_log: right after the last (innocent) request before the crash must have happened, there was a string of 762 \x00 characters, and then nothing until the time I rebooted the machine this morning. Does anyone have an idea what this could be? Thanks, Jan Pieter Kunst
/ 2003-12-15 10:01:34 +0100 \ Jan Pieter Kunst:
Dear people,
I'm only an amateurish part-time sysadmin, so please bear with me.
This weekend our web server (SuSE 8.0) crashed. The machine could be pinged, but did not respond to http or ssh requests.
When I came in this morning, I could not get the screen to wake up, so I had to forcibly reboot the machine.
After rebooting, I checked the logfiles (at least those that I know about) and the only one in which something strange appeared was Apaches access_log: right after the last (innocent) request before the crash must have happened, there was a string of 762 \x00 characters, and then nothing until the time I rebooted the machine this morning.
Does anyone have an idea what this could be?
normal filesystem "corruption" after hard crash: unflushed, but allocated, blocks are zeroed out by journal replay or fsck. so related to you switching off the box, but no hint whatsoever to the cause of the hang. Lars Ellenberg
Does anyone have an idea what this could be?
normal filesystem "corruption" after hard crash: unflushed, but allocated, blocks are zeroed out by journal replay or fsck. so related to you switching off the box, but no hint whatsoever to the cause of the hang.
Good analysis. And right, there is no indication about the origin of the hang. This is not nice, yes, but it could remain unanswered unless more specifics are known.
Lars Ellenberg
Thanks, Roman. -- - - | Roman Drahtmüller <draht@suse.de> // Nail here | SUSE Linux AG - Security Phone: // for a new | Nürnberg, Germany +49-911-740530 // monitor! --> [x] | - -
normal filesystem "corruption" after hard crash: unflushed, but allocated, blocks are zeroed out by journal replay or fsck. so related to you switching off the box, but no hint whatsoever to the cause of the hang.
Good analysis. And right, there is no indication about the origin of the hang. This is not nice, yes, but it could remain unanswered unless more specifics are known.
Lars Ellenberg
Thanks, Roman.
The problem is I'm not sure where to look for more specifics. Are there other logfiles that could be relevant? Jan Pieter Kunst
On Mon, 15 Dec 2003 10:01:34 +0100, Jan Pieter Kunst <jan.pieter.kunst@meertens.knaw.nl> wrote:
Apaches access_log: right after the last (innocent) request before the crash must have happened, there was a string of 762 \x00
... what about in 'error_log' ??? anything? -- << http://michaeljtobler.homelinux.com/ >> Trying to define yourself is like trying to bite your own teeth.
On Mon, 15 Dec 2003 10:01:34 +0100, Jan Pieter Kunst <jan.pieter.kunst@meertens.knaw.nl> wrote:
Apaches access_log: right after the last (innocent) request before the crash must have happened, there was a string of 762 \x00
... what about in 'error_log' ??? anything?
No, nothing interesting. The last message in error_log before the crash is [Fri Dec 12 19:59:44 2003] [error] [client xx.xxx.xx.xx] client denied by server configuration: /path/to/directory ... where /path/to/directory is protected with a 'Deny,allow' directive in a .htaccess file. Jan Pieter Kunst
participants (4)
-
Jan Pieter Kunst -
Lars Ellenberg -
mjt -
Roman Drahtmueller